Virtual private network dead peer detection
View Patent ↗Methods and systems are provided for detecting dead tunnels associated with a VPN. An indicator of a tunnel capability, for example, a DPD vendor ID, is received from a peer through a VPN connection. The tunnel capability is associated with one or more phase II tunnels associated with the VPN. Traffic generated by the peer is detected, and if traffic is detected at a tunnel, the tunnel is presumed to be alive. When no traffic is detected in a tunnel, a DPD packet exchange with the tunnel is initiated. A determination is made, based on the packet exchange, whether the tunnel is alive.
1. A method for identifying a dead peer, comprising:
receiving an indicator of a tunnel capability from the peer through a Virtual Private Network (VPN) connection identifying that more than one phase II tunnels may be established with the peer;
establishing a first phase II tunnel and a second phase II tunnel with the peer;
detecting traffic generated by the peer over the first and the second phase II tunnel;
initiating a packet exchange over the first phase II tunnel when no traffic is detected in the first phase II tunnel; and
identifying, based on the packet exchange that the first phase II tunnel is dead.
2. The method of claim 1 , wherein the indicator includes a dead peer detection (DPD) vendor identifier, wherein the DPD vendor identifier is indicative of phase II DPD capability.
3. The method of claim 2 , wherein the VPN connection is associated with the more than one phase II tunnels within the VPN connection.
4. The method of claim 3 , wherein the packet exchange is a phase II DPD packet exchange.
5. The method of claim 1 , further comprising:
starting a first timer when a VPN connection is established with the first phase II tunnel; and
restarting the first timer when traffic is detected in the first phase II tunnel.
6. The method of claim 5 , wherein the packet exchange is initiated when the first timer expires.
7. The method of claim 1 , wherein the first tunnel is identified to be dead after a predetermined number of packet exchanges over the first tunnel fail.
8. The method of claim 7 , wherein the predetermined number of packet exchanges is three.
9. The method of claim 7 , further comprising renegotiating a security association with the peer to reestablish a VPN connection with the first phase II tunnel after identifying that the first phase II tunnel is dead.
10. The method of claim 7 , further comprising deleting the first phase II tunnel after identifying that the first tunnel is dead.
11. A system for identifying a dead peer, comprising:
a processor;
a memory; and
one or more modules stored in the memory and executable by the processor to: receive an indicator of a tunnel capability from a peer through a Virtual Private Network (VPN) connection, the indicator identifying that more than one phase II tunnels may be established with the peer;
establish a first phase II tunnel and a second phase II tunnel with the peer;
detect traffic generated by the peer over the first and the second phase II tunnel;
initiate a packet exchange over the first phase II tunnel when no traffic is detected in the first phase II tunnel; and
identify, based on the packet exchange that the first phase II tunnel is dead.
12. The system of claim 11 , wherein the indicator includes a dead peer detection (DPD) vendor identifier, wherein the DPD vendor identifier is indicative of phase II DPD capability.
13. The system of claim 12 , wherein the VPN connection is associated with the more than one phase II tunnels within the VPN connection.
14. The system of claim 13 , wherein the packet exchange is a phase II DPD packet exchange.
15. The system of claim 11 , wherein the one or more modules are further executable by the processor to:
start a first timer when a VPN connection is established with the first phase II tunnel; and
restart the first timer when traffic is detected in the first phase II tunnel.
16. The system of claim 15 , wherein the packet exchange is initiated when the first timer expires.
17. The system of claim 11 , wherein the first tunnel is identified to be dead after a predetermined number of packet exchanges over the first tunnel fail.
18. The system of claim 17 , wherein the predetermined number of packet exchanges is three.
19. The system of claim 17 , wherein the one or more modules are further executable by the processor to renegotiate a security association with the peer to reestablish a VPN connection with the first tunnel after identifying that the first tunnel is dead.
20. The system of claim 17 , wherein the one or more modules are further executable by the processor to delete the first tunnel after identifying that the first tunnel is dead.
21. A non-transitory computer readable storage medium having embodied thereon a program executable by a processor to perform a method for identifying a dead peer, the method comprising:
receiving an indicator of a tunnel capability from the peer through a Virtual Private Network (VPN) connection identifying that more than one phase II tunnels may be established with the peer;
establishing a first phase II tunnel and a second phase II tunnel with the peer;
detecting traffic generated by the peer over the first and the second phase II tunnel;
initiating a packet exchange over the first phase II tunnel when no traffic is detected in the first phase II tunnel; and
identifying, based on the packet exchange that the first phase II tunnel is dead.
22. The non-transitory computer readable storage medium of claim 21 , wherein the indicator includes a dead peer detection (DPD) vendor identifier, wherein the DPD vendor identifier is indicative of phase II DPD capability.
23. The non-transitory computer readable storage medium of claim 22 , wherein the VPN connection is associated with the more than one phase II tunnels within the VPN connection.
24. The non-transitory computer readable storage medium of claim 23 , wherein the packet exchange is a phase II DPD packet exchange.
25. The non-transitory computer readable storage medium of claim 21 , the method further comprising:
starting a first timer when a VPN connection is established with the first phase II tunnel; and
restarting the first timer when traffic is detected in the first phase II tunnel.
26. The non-transitory computer readable storage medium of claim 25 , wherein the packet exchange is initiated when the first timer expires.
27. The non-transitory computer readable storage medium of claim 21 , wherein the first tunnel is identified to be dead after a predetermined number of packet exchanges with first the tunnel fail.
28. The non-transitory computer readable storage medium of claim 27 , wherein the predetermined number of packet exchanges is three.
29. The non-transitory computer readable storage medium of claim 27 , the method further comprising renegotiating a security association with the peer to reestablish a VPN connection with the first tunnel after identifying that the first tunnel is dead.
30. The non-transitory computer readable storage medium of claim 27 , the method further comprising deleting the first tunnel after identifying that the first tunnel is dead.